1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
Michael W. Sobol (State Bar No. 194857)
msobol@lchb.com
Melissa Gardner (State Bar No. 289096)
mgardner@lchb.com
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: 415.956.1000
Facsimile: 415.956.1008
Rachel Geman
rgeman@lchb.com
Nicholas Diamand
ndiamand@lchb.com
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: 212.355.9500
Facsimile: 212.355.9592
Hank Bates (State Bar No. 167688)
hbates@cbplaw.com
Allen Carney
acarney@cbplaw.com
David Slade
dslade@cbplaw.com
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: 501.312.8500
Facsimile: 501.312.8505
17
Attorneys for Plaintiffs
18
UNITED STATES DISTRICT COURT
19
NORTHERN DISTRICT OF CALIFORNIA
20
21
22
MATTHEW CAMPBELL and MICHAEL
HURLEY, on behalf of themselves and all
others similarly situated,
Case No. ________
CLASS ACTION COMPLAINT
23
Plaintiffs,
24
v.
25
FACEBOOK, INC.,
26
Defendant.
27
28
CLASS ACTION COMPLAINT
1147096.1
1
2
CLASS ACTION COMPLAINT
I.
INTRODUCTION
1.
3
The right of privacy is a personal and fundamental right in California 1 and the
4
United States. 2 An individual’s privacy is directly implicated by the collection, use, and
5
dissemination of personal information. Defendant Facebook, Inc. (“Facebook” or “the
6
Company”) has systematically violated consumers’ privacy by reading its users’ personal, private
7
Facebook messages without their consent.
2.
8
9
Facebook is a social-networking site that boasts more than one billion users
worldwide, making it the largest online social network in the world.
3.
10
Across the various services it offers, Facebook takes pains to promise a stark
11
distinction in the types of communications it facilitates. Users may choose to communicate
12
publicly via individual Facebook pages, or privately via personal messages and chats. 3
4.
13
Specifically, Facebook describes communication options “[d]epending on whom
14
you’d like to share with.” The options range from the broadest possible audience (a post which
15
the public may see, including via searches on the internet), to posts viewable by small groups of
16
friends, to Facebook messages shared “privately” with a single individual. 4 Facebook touts the
17
privacy of its messaging function as “unprecedented” in terms of user control and the prevention
18
of unwanted contact. 5
19
20
21
22
23
24
25
26
27
28
1
CAL. CONST., Art. I, § 1, adopted as ballot measure in 1972 (“All people are by nature free
and independent and have inalienable rights. Among these are enjoying and defending life and
liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety,
happiness, and privacy.”). See also Am. Acad. of Pediatrics v. Lungren, 16 Cal. 4th 307, 326
(1997) (“[T]he scope and application of the state constitutional right of privacy is broader and
more protective of privacy than the federal constitutional right of privacy as interpreted by the
federal courts.”).
2
Dep’t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989) (“both
the common law and the literal understandings of privacy encompass the individual’s control of
information concerning his or her person”); Whalen v. Roe, 429 U.S. 589, 605 (1977).
3
The distinction between “messages” and “chats” on Facebook is one of timing: chats happen in
real-time and often give the appearance of conversation, whereas messages act more like email.
4
Help Center: Get Started on Facebook: How to Post & Share, Facebook,
https://www.facebook.com/help/333140160100643/.
5
Joel Seligstein, See the Messages that Matter, Facebook,
https://www.facebook.com/notes/facebook/see-the-messages-that-matter/452288242130.
1147096.1
-1-
CLASS ACTION COMPLAINT
1
5.
Contrary to its representations, “private” Facebook messages are systematically
2
intercepted by the Company in an effort to learn the contents of the users’ communications. In
3
the course of the last year, independent security researchers discovered that Facebook reviews the
4
contents of its users’ private Facebook messages for purposes unrelated to the facilitation of
5
message transmission. When a user composes a Facebook message and includes a link to a third
6
party website (a “URL”) 6, the Company scans the content of the Facebook message, follows the
7
enclosed link, and searches for information to profile the message-sender’s web activity.
8
9
10
6.
This practice is not done to facilitate the transmission of users’ communications
via Facebook, but because it enables Facebook to mine user data and profit from those data by
sharing them with third parties – namely, advertisers, marketers, and other data aggregators.
11
7.
Representing to users that the content of Facebook messages is “private” creates
12
an especially profitable opportunity for Facebook, because users who believe they are
13
communicating on a service free from surveillance are likely to reveal facts about themselves that
14
they would not reveal had they known the content was being monitored. Thus, Facebook has
15
positioned itself to acquire pieces of the users’ profiles that are likely unavailable to other data
16
aggregators.
17
8.
Almost the entirety of Facebook’s revenues derive from the sale of third party
18
advertisements, which the Company is able to target towards its users based upon the personal
19
data it mines and stores. In 2011, Facebook earned $2.7 billion from targeted advertising sales.
20
The more otherwise-unavailable information the Company can collect about its users – including
21
the contents of their private communications – the more valuable its advertising capacity.
22
Accordingly, Facebook promotes itself as a rich source of information about the people who use
23
the site, one which allows businesses to “reach the right people,” through selective targeting of
24
25
26
27
28
6
A “URL,” or “uniform resource locator” is also known as a “web address.” It is a character
string that refers to a specific resource or location on the Internet. For example,
“www.nytimes.com” is the URL for the New York Times’ home page.
1147096.1
-2-
CLASS ACTION COMPLAINT
1
potential customers by, for example, “location,” “age,” or “interests” 7 drawn from “activities,
2
education, job titles, Pages they like or groups to which they belong.”8
3
9.
All of Facebook’s activities complained of herein are performed without users’
4
consent. Instead, to increase users’ comfort with the website and, thereby, increase the amount of
5
information they share, the Company makes assurances of user control over privacy settings and
6
messaging options. These assurances affirmatively state that only senders and intended recipients
7
are privy to the contents of their nonpublic communications. In reality, Facebook never intended
8
to provide this level of confidentiality. Instead, Facebook mines any and all transmissions across
9
its network, including those it labels “private,” in order to gather any and all morsels of
10
information it can about its users.
11
10.
Plaintiffs Matthew Campbell and Michael Hurley are Facebook users who, during
12
the relevant Class Period, utilized Facebook’s private messaging function, each relying on
13
representations that these private and personal communications would be viewed only by the
14
sender and the recipient. Instead, where Plaintiffs sent private messages containing URLs,
15
Facebook scanned Plaintiffs’ messages and searched the website identified in the URL for
16
purposes including but not limited to data mining and user profiling.
17
11.
While Facebook hides the extent of this intrusive behavior from its users, it is
18
candid about these activities in its technical guidance for web developers. Web developers are
19
computer programmers who specialize in the development of internet applications, or distributed
20
network applications that are run from a web server 9 to a web browser, 10 over HTTP. 11 Web
21
22
23
24
25
26
27
28
7
Reach the right people, Facebook, https://www.facebook.com/business/a/online-sales/targetyour-ads.
8
How to target Facebook ads, Facebook, https://www.facebook.com/business/a/online-sales/adtargeting-details.
9
A web server can refer to either the hardware (the computer) or the software (the computer
application) that helps deliver web content that can be accessed through the Internet.
10
A web browser is a software application for retrieving, presenting and traversing information
resources on the Internet.
11
HTTP or “Hypertext Transfer Protocol” is a set of standards that allows users of the World
Wide Web to exchange information found on web pages. When an internet user enters “http://” in
front of a web address, this tells the web browser to communicate over HTTP. An HTTP request
is a request sent by a “client” to a “server” via the internet, asking for information contained on
the server. The most common example of this is when a web browser (e.g., Internet Explorer)
sends a request to a server to call up the information associated with a web page’s URL. For
1147096.1
-3-
CLASS ACTION COMPLAINT
1
developers are website administrators to whom Facebook offers or allows access to data created
2
by its users’ web traffic. Some of these web developers work at Facebook, while others work for
3
companies that do business with Facebook, and still others are freelancers or contractors.
4
12.
This class action is brought on behalf of all natural person Facebook users located
5
within the United States who have sent or received private Facebook messages that included a
6
URL in the content of the Facebook message. Upon information and belief, Facebook read these
7
private Facebook messages.
8
9
13.
Such actions, described in detail below, are intentional interceptions of electronic
communications, committed in violation of the Electronic Communications Privacy Act,
10
18 U.S.C. §§ 2510 et seq. (“ECPA”), California’s Invasion of Privacy Act, Cal. Penal Code
11
§§ 630 et seq. (“CIPA”), and the California Unfair Competition Law (“UCL”).
12
14.
Under ECPA, the CIPA, and the UCL, Plaintiffs seek, individually and on behalf
13
of the Class, injunctive and declaratory relief, restitution, statutory damages, an award of
14
reasonable attorney’s fees and other litigation costs reasonably incurred, and any and all
15
additional relief deemed appropriate by this Court.
16
II.
17
THE PARTIES
15.
Plaintiff Matthew Campbell a resident of Pulaski County, Arkansas. He
18
established a Facebook account in or around January 2009, which he has maintained consistently
19
to the present day. He has used Facebook’s private messaging function throughout the relevant
20
Class Period for, inter alia, purposes of conveying messages whose content includes URL links.
21
16.
Plaintiff Michael Hurley is a resident of North Plains, Oregon. He established a
22
Facebook account in or around October 2008, which he has maintained consistently to the present
23
day. He has used Facebook’s private messaging function throughout the relevant class period for,
24
inter alia, purposes of conveying messages whose content contains URL links.
25
26
27
28
instance, where one enters the URL “www.nytimes.com” into the address bar of a web browser
(the client) and hits the “Enter” button on the keyboard, the web browser will send a request to
the New York Times’ server for information associated with the front page of the Times’ website.
The server responds to the request by sending this information to the client, which then displays
the webpage.
1147096.1
-4-
CLASS ACTION COMPLAINT
1
17.
Defendant Facebook, Inc. is an American corporation, headquartered in Menlo
2
Park, California, and incorporated under the laws of the State of Delaware. Facebook owns and
3
operates an online social networking website that allows its users to communicate with each other
4
through the sharing of text, photograph, and video.
5
III.
6
JURISDICTION, VENUE, AND CHOICE OF LAW
18.
Pursuant to 28 U.S.C. § 1331, this Court has original subject matter jurisdiction
7
over the claims of Plaintiffs and the Class that arise under the Electronic Communications
8
Privacy Act of 1986 (“ECPA”), 18 U.S.C. §§ 2510 et seq.
9
19.
Further, this Court has subject matter jurisdiction over this putative nationwide
10
class action pursuant to 28 U.S.C. § 1332, as amended by the Class Action Fairness Act of 2005
11
(“CAFA”), because the matter in controversy exceeds $5,000,000.00, exclusive of interest and
12
costs, and is a class action in which some members of the Class are citizens of states different
13
than Defendant. See 28 U.S.C. § 1332(d)(2)(A). Therefore, both elements of diversity
14
jurisdiction under CAFA are present, and this Court has jurisdiction.
15
20.
This Court has personal jurisdiction over Facebook because Facebook owns and
16
operates a business that is headquartered in California, and because it conducts substantial
17
business throughout California.
18
19
21.
Venue properly lies in this district pursuant to 28 U.S.C. § 1391(b)(1), as
Facebook is headquartered in this district.
20
22.
Venue is also proper in this district pursuant to Facebook’s Statement of Rights
21
and Responsibilities, which governs the agreement between Plaintiffs and Facebook and which
22
states in pertinent part that Plaintiffs “will resolve any claim, cause of action or dispute (claim) . .
23
. relating to . . . Facebook exclusively in a state or federal court located in Santa Clara County.”
24
23.
California law governs the substantive legal issues in the instant matter, as
25
Facebook’s Statement of Rights and Responsibilities further states in pertinent part that “the laws
26
of the State of California will govern . . . any claim that might arise between you and us.”
27
28
1147096.1
-5-
CLASS ACTION COMPLAINT
1
IV.
FACTUAL BACKGROUND
2
A.
Data Aggregation
3
24.
Many websites capitalize on the personal information they can collect from users.
4
Some sell the data directly; some use the data to build valuable profiles of users for sale or their
5
own use.
25.
6
Data aggregation and sale are highly lucrative, both in the United States and
7
abroad. In the United States alone, data-driven marketing was reportedly worth $156 billion in
8
2012, 12 whereas a recent Boston Consulting Group Report puts the numbers in Europe even
9
higher: it estimates a total “digital identity value” of Europeans in 2011 as €315 billion, a number
10
expected to reach €1 trillion by 2020. 13
26.
11
Even though many websites remove personally identifiable information from data
12
when they are initially sold, data aggregators are employing ever more sophisticated cross-
13
referencing and predictive analytics techniques to make more sources of data personally
14
identifiable. 14
27.
15
Widespread dissemination of even de-identified data is already causing problems
16
for internet users. Kate Crawford, a visiting professor at the MIT Center for Civic Media and a
17
principal researcher at Microsoft Research, and Jason Shultz, of the New York University School
18
of Law, explain the privacy risks arising from new methods of data aggregation and analysis:
Even very vague signals online, such as liking things on Facebook,
can generate a detailed picture. As one University of Cambridge
study found, ‘highly sensitive personal attributes,’ such as sexual
orientation, ethnicity, religious and political views, personality
traits, intelligence, use of addictive substances, parental separation,
age and gender were predictable with high degrees of success just
from what people liked online. Thus, racial discrimination could be
applied to prevent some candidates from seeing loans that might be
19
20
21
22
23
12
24
25
26
27
28
US Data Marketing ‘Worth $156 bn,’ Warc (fka World Advertising Research Center) (Oct. 16,
2013),
http://www.warc.com/Content/News/N32077_US_data_marketing_worth_24156bn_.content?CI
D=N32077&ID=6bba593a-da7f-433f-9030-c2c91452cc4b&q=direct+response+advertising&qr=.
13
The Value of Our Digital Identity, The Boston Consulting Group (Nov. 2012),
http://www.libertyglobal.com/PDF/public-policy/The-Value-of-Our-Digital-Identity.pdf.
14
Kate Crawford and Jason Schultz, Big Data and Due Process: Toward a Framework to
Redress Predictive Privacy Harms, New York University School of Law Public Law & Legal
Theory Research Paper Series, Working Paper No. 13-64 at 8 (Oct. 2013),
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2325784.
1147096.1
-6-
CLASS ACTION COMPLAINT
1
advantageous to them, and housing renters and sellers could
potentially use big data to discriminate based on gender, all while
circumventing the fair housing laws. 15
2
28.
3
4
Information that people never intended to make public can be used against them in
other ways, such as to deny healthcare coverage. According to Crawford and Schulz:
[D]ata about our online behavior generally – such as buying an ebook about breast cancer survival or liking a disease foundation’s
Facebook page – can also reveal information about our health . . .
When these data sets are cross-referenced with traditional health
information, as big data is designed to do, it is possible to generate
a detailed picture about a person’s health, including information a
person may never have disclosed to a health provider. The
combination of data sets and use of predictive analytics can
dramatically increase the amount of data that can be considered
private. 16
5
6
7
8
9
10
29.
In another example of the uses to which data aggregators are putting predictive
11
analytics, a recent New York Times blog post reported that one man saw his American Express
12
credit card limit reduced because, according to American Express, “Other customers who have
13
used their card at establishments where you recently shopped have a poor repayment history with
14
American Express.” 17
15
30.
Even if a company only stores user information, and does not immediately use the
16
data it gleans from users’ private messages to target advertisements or for any purpose directly
17
associated with the individual, it may sell that information at its discretion, and it can be resold by
18
any company that buys it. Companies that acquire user data can retain that information
19
indefinitely and use it for any purpose not prohibited by law or contract.
20
31.
This puts people at risk of crime, discrimination, or embarrassment, and they are
21
powerless to stop it because once a company like Facebook obtains their data, users have no
22
control over subsequent analysis, sale, or other use of the data.
23
24
32.
Widespread dissemination of information about individuals empowers the
government against citizens to a degree well beyond the contemplation of the Fourth
25
26
27
28
15
Id.
Id. at 6.
17
Lily Altavena, What Story Does Your Personal Data Tell?, N.Y. Times, The Learning Network
(Feb. 17, 2013), http://learning.blogs.nytimes.com/2012/02/07/what-story-does-your-personaldata-tell/.
16
1147096.1
-7-
CLASS ACTION COMPLAINT
1
Amendment. Facebook declares that it only provides the stored contents of any account to the
2
government with a warrant, 18 yet it has been reported that the companies that purchase such
3
information can hand it over to government agencies with no probable cause and with no
4
warrant. 19
5
33.
6
Foreign regimes may also gain access to users’ private data after it has been
aggregated by companies like Facebook. 20
7
34.
Furthermore, if companies like Facebook do not have to adhere to terms of their
8
own policies and representations regarding what data they collect, there is no basis for consumer
9
trust. Ultimately, the duplicity alleged herein by entities like Facebook will likely cause
10
consumers to assume that all communications they make are recorded and disseminated,
11
significantly chilling free speech.
12
35.
In response to the threats posed by internet privacy invasions, the Department of
13
Commerce has recently recommended basic principles for internet regulation that align with the
14
goals underlying the CIPA and the ECPA. First articulated by the Department of Health and
15
Human Services more than 30 years ago, they are known as the Fair Information Practice
16
Principles (“FIPPs”). The FIPPs stand for eight relatively straightforward ideas:
17
•
Transparency: Individuals should have clear notice about the data
collection practices involving them.
•
Individual Participation: Individuals should have the right to consent to the
use of their information.
•
Purpose Specification: Data collectors should describe why they need
particular information.
•
Data Minimization: Information should only be collected if it is needed.
18
19
20
21
22
23
18
24
25
26
27
28
Information for Law Enforcement Authorities, Facebook,
https://www.facebook.com/safety/groups/law/guidelines/.
19
American Civil Liberties Union, Focus on Data Aggregation, at 2 (June 2010) (“The federal
government is also a customer of private data companies. It’s cheaper to buy information that’s
already been assimilated; it also avoids warrants or court oversight.”)
20
Repressive regimes like Iran have demonstrated an interest in the online activities of U.S.
citizens. For example, dozens of American Facebook users who posted political messages critical
of Iran have reported that Iranian authorities subsequently questioned and detained their relatives.
Electronic Privacy Information Center, Frequently Asked Questions Regarding EPIC’s Facebook
Complaint, http://epic.org/privacy/socialnet/fbfaq.html.
1147096.1
-8-
CLASS ACTION COMPLAINT
•
Use Limitation: Information collected for one purpose should not be used
for another.
3
•
Data Quality and Integrity: Information should be accurate.
4
•
Security: Information should be kept secure.
5
•
Accountability and Auditing: Data collectors should know who has
accessed information and how it is used.
B.
Facebook
36.
With 1.1 billion users accessing this service on a monthly basis – approximately
1
2
6
7
8
51% of all internet users – Facebook is the world’s largest social media company.
9
37.
The popularity of Facebook hinges upon the ability of its users to communicate
10
with one another. As the Company stated in a Securities and Exchange Commission filing in
11
anticipation of its May 2013 initial public offering or “IPO,” “[p]eople use Facebook to stay
12
connected with their friends and family, to discover what is going on in the world around them,
13
and to share and express what matters to them to the people they care about. . . . We believe that
14
we are at the forefront of enabling faster, easier, and richer communication between people and
15
that Facebook has become an integral part of many of our users’ daily lives.” 21
16
38.
Communications among Facebook users span a continuum, from the publicly
17
viewable to the entirely private. In the Facebook tutorial “Get Started on Facebook,” guidance is
18
offered on how to share or send information via the service, either publicly or privately:
19

20
How to Post & Share

21
How do I share a status or other content on Facebook?
22
Depending on whom you’d like to share with, there are different ways to
share content on Facebook:
23

24
25
26
27
28
Sharing Status Updates and Other Stories
Sharing with a broad audience: Use the share menu that’s located at
the top of your homepage and timeline to let others know what’s on your
mind. You can update your status and share photos, videos, links and
other application content. Things you share will appear as posts on your
timeline, and can appear in your News Feed. To control whether or not
21
Form S-1 Registration Statement for Facebook, Inc., as filed with the Securities and Exchange
Commission, “Prospectus Summary,” at 1 (Feb. 1, 2012),
http://www.sec.gov/Archives/edgar/data/1326801/000119312512034517/d287954ds1.htm.
1147096.1
-9-
CLASS ACTION COMPLAINT
specific people have the option to view your stories, you can change the
privacy settings for each piece of content you post.
1
2

Sharing with a small group of friends: Use the Groups feature to
share content with a select group of people, like family members, your
soccer team or your book club.

Sharing with an individual: You can use the share menu at the top of
a friend’s timeline to write or share something on his or her timeline.
Friends of your friend will also be able to view your post. I f you’d like to
3
4
5
share som ething privately, you can alw ays send som eone a
private m essage. 22
6
7
39.
Thus, Facebook states that its private messaging function is meant to be precisely
8
that: a “private” mechanism for communication between individuals using the Company’s
9
services. Further, Facebook telegraphs through the use of the words “privately” and “private”
10
that when a user sends a private message to another party, only the user and the intended recipient
11
will be privy to the contents of that communication.
12
1.
13
40.
Facebook’s Private Messaging Function
On November 15, 2010, Facebook announced a new, integrated email and
14
messaging service for its users. Combining the functionality of email, chat, SMS, 23 and in-
15
service messaging into a single platform, Facebook’s private messaging service enables Facebook
16
users to communicate directly with specifically chosen individuals, in a single conversation,
17
across devices and through a variety of popular media. 24 Because the messaging service can also
18
serve as an email address, account holders can also use Facebook as a means of sending messages
19
to, and receiving messages from, sources outside the Company’s social media network.
20
41.
Facebook took special pains to tout the privacy features of its new private
21
messaging service. In its rollout announcement, it said “[y]ou can also change your account
22
settings to be even more limited and bounce any emails that aren’t exclusively from friends. This
23
kind of message control is pretty unprecedented and people have been wanting to do this with
24
email (and phone calls) for a long time. ‘Messages’ reverses the approach to preventing
25
26
27
28
22
Help Center: Get Started on Facebook: How to Post & Share (italic and bold emphasis added).
“SMS” is an acronym for “short message service,” commonly known as “text messaging.”
24
See the Messages that Matter
23
1147096.1
- 10 -
CLASS ACTION COMPLAINT
1
unwanted contact. Instead of having to worry about your email address getting out, you’re now
2
in control of who can actually reach you.” 25
3
4
42.
Thus, in Facebook’s inaugural representations of its private messaging service, it
stressed “unprecedented” amounts of (1) user control and (2) user privacy inherent in its product.
5
43.
Where Facebook discusses its private messaging service on its website, it does so
6
in terms that expressly contemplate a private communication, taking place only between the
7
sender and the intended recipient or recipients (e.g., “If you’d like to share something privately,
8
you can always send someone a private message” 26 and “unprecedented” levels of “message
9
control” 27). Additionally, Facebook’s website contains a “Help Center” which assists account
10
holders in utilizing basic functions of the service. In the Help Center, under the heading “How do
11
I send a message” the step-by-step instruction begins with the prompt “To send a private
12
message.” 28 Under the heading “Who can see my message,” Facebook states “You and the
13
people you’re messaging with can view the contents and history of your conversation.” 29
14
44.
All of these representations reflect the promise that only the sender and the
15
recipient or recipients will be privy to the private message’s content, to the exclusion of any other
16
party, including Facebook.
17
2.
18
19
45.
Third-Party Security Researchers Demonstrate that Facebook is
Intercepting and Scanning the Content of “Private” Messages
Facebook’s representations of privacy have been discredited by security
20
researchers over the past year. Facebook has been caught surreptitiously intercepting and
21
scanning the contents of its users’ private messages for a variety of purposes, none of which
22
Facebook discloses in either its Terms of Use or its Privacy Policy.
23
24
25
26
27
28
25
Id. (emphasis added).
Help Center: Get Started on Facebook: How to Post & Share (emphasis added).
27
See the Messages that Matter
28
Help Center: Messaging: Messages: Sending a Message: How Do I Send a Message?,
Facebook, https://www.facebook.com/help/326534794098501/, (emphasis added).
29
Help Center: Messaging: Messages: Settings & Security: Who Can See My Messages?,
Facebook,
https://www.facebook.com/help/212388195458335?sr=16&sid=0ntT7VdfDjw7Y5KSV.
26
1147096.1
- 11 -
CLASS ACTION COMPLAINT
1
46.
On August 27, 2013, a Swiss security firm announced that it had conducted a
2
simple experiment to test how scrupulously the fifty largest social networks, web services, and
3
free email systems (“Web Services”) respected user privacy. 30 The firm, High-Tech Bridge
4
(“HTB”), used a dedicated web server and generated a secret URL for each of the Web Services.
5
HTB then used the private messaging function of each of the Web Services, embedding a unique
6
URL in each message.
7
47.
HTB then monitored its dedicated web server’s logs for all incoming HTTP
8
requests, in order to see whether any of the Web Services would “click” on the test URLs that had
9
been transmitted via private message.
10
11
48.
Facebook was one of the Web Services that was caught scanning URLs despite
such activity remaining undisclosed to the user.
12
49.
Concerning Facebook’s scanning of the contents of privately sent messages,
13
HTB’s Chief Research Officer stated, “there is no way to keep the URL and its content
14
confidential . . . while transferring the URL via social networks.” 31
15
50.
Facebook performs this task to aggregate data on its users for purposes of
16
advertising, marketing and user profiling; specifically, at least in part, in the form of generating
17
“Likes” for web pages, generated via Facebook’s social plugins embedded on websites, thereby
18
monitoring users’ web browsing patterns.
19
3.
20
51.
Facebook’s Social Plugins
In addition to having users interact on its own website, Facebook also provides
21
code for third-party websites to embed, so-called “social plugins.” Facebook explains the social
22
plugin as follows,
23
Alright, so this is how it works. Let’s say you are logged in to
Facebook, but you check out a popular new site. It’s kind of a
bummer, because before you would have to choose between the
social experience of Facebook or the specialized information of a
content site. Ok, well now, if the website has a social plug-in, you
can take your Facebook friends with you and get both. Instead of
having to comb through page after page of article after article to
24
25
26
27
28
30
High-tech Bridge, Social Networks: Can Robots Violate User Privacy? (Aug. 27, 2013),
https://www.htbridge.com/news/social_networks_can_robots_violate_user_privacy.html.
31
Id.
1147096.1
- 12 -
CLASS ACTION COMPLAINT
1
find something that catches your eye, now you can see what your
friends have already enjoyed on a site. And with one click, you can
share an article or a video review with your friends. 32
2
52.
3
The effect of embedding social plugins into third-party websites is that it enables
4
Facebook to extend its data gathering practices, keeping tabs on its users’ behavior even after
5
they log out of Facebook. One of the principal social plugins is the “Like” button commonly
6
found on internet websites. 33 A video tutorial on Facebook’s website states:
7
When someone clicks “Like,” they’re highlighting the things that
are valuable to them and sharing that with their friends. And when
all of this goes to your News Feed, it’s like you have a real time,
super-customized window to the most valuable things on the
Internet. But we understand that many of the things people care
about live outside of Facebook, so we wanted to create a way to
bring your friends with you to other websites. So we created social
plugins. Social plugins extend the things you love about Facebook
to your favorite websites. 34
8
9
10
11
53.
12
In practice, Facebook social plugins serve as an extension of Facebook on the
13
internet at large. In addition to Facebook’s “Like” button at the top of a news article, Facebook’s
14
social plugins can take the form of a sidebar feed noting any friends who have read or
15
recommended the article, or a clickable Facebook icon, as circled below.
16
17
18
19
35
20
21
22
54.
across the world’s largest social network, the Company offers this assurance:
23
When you start to see websites that are customized for you all over
the Internet, you might wonder if everyone else can see it. But it’s
not like that. Although you can see customized information on
other sites, all the information lives on Facebook, and Facebook
24
25
26
27
28
If users are concerned that their extra-Facebook web traffic is being broadcast
32
Understanding Social Plugins, Facebook tutorial video at 0:40 – 1:09 (posted June 7, 2010),
https://www.facebook.com/video/video.php?v=10150210521510484.
33
Id. (listing the “Like” button as one of “the main social plugins.”).
34
Id. at 0:15 – 0:39
35
Somini Sengupta, The Information Gathering Paradox, N.Y. Times, Oct. 26, 2013.
1147096.1
- 13 -
CLASS ACTION COMPLAINT
1
doesn’t share your information with anyone through social plugins.
And each person has full control of what they want to share.
You’re only sharing the information you want to, and you’re only
sharing it with the people you want to share it with. 36
2
3
55.
4
In October 2012, a security researcher published findings in the Wall Street
5
Journal showing that Facebook scans users’ private messages for URLs. 37 When a private
6
message contains a link to a third-party website, and that website has a “Like” social plugin,
7
Facebook registers up to two “Likes” for that web page via the social media plugin. 38
56.
8
9
In this first screenshot, the website set up by the security researcher, Ashkan
Soltani, “ashkansoltani.org/fb_test.html,” has two (2) likes registered to it.
10
11
12
13
14
Soltani also provided the html code for the website:
15
16
17
18
19
20
21
22
23
Soltani then logged into Facebook and sent a message that contained the URL and the text
24
“testing 1 2 3.”
25
26
36
27
28
Understanding Social Plugins, at 1:14 – 1:37 (emphasis added).
Jennifer Valentino-DeVries and Ashkan Soltani, How Private Are Your Private Facebook
Messages?, Wall St. J., Oct. 3, 2012.
38
Id.
37
1147096.1
- 14 -
CLASS ACTION COMPLAINT
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
Finally, Soltani navigated back to his test website to see if the number of “Likes” registered to it
increased, which they did. 39
19
20
21
22
57.
23
The article notes that this practice is described in Facebook’s guidance for
24
developers – administrators of the third-party websites whom Facebook seeks to entice to use
25
social plugins. The developer guidance states that “the number of inbox messages containing” a
26
27
28
39
Indeed, as a result of a technical glitch at the time, Facebook added two “Likes” per URL
instead of one. A video showing Soltani complete this test in real-time can be found as part of the
Digital Trends article reporting on it. See Molly McHugh, Facebook Scans Private Messages for
Brand Page Mentions, Admits a Bug Is Boosting Likes, Digital Trends (Oct. 4, 2012),
http://www.digitaltrends.com/social-media/facebook-scans-private-messages/.
1147096.1
- 15 -
CLASS ACTION COMPLAINT
1
link to a page will count as ‘Likes.’” 40 However, this practice – scanning private messages and
2
doling out “Likes” to websites if a hyperlink is contained therein – is not disclosed anywhere in
3
Facebook’s Privacy Policy.
4
58.
Beyond scanning messages for social plugin purposes, Facebook also has
5
conceded that it uses a combination of software and human screening to comb through private
6
messages and search for criminal activity. 41 Upon information and belief, this practice extends
7
beyond the scanning of URLs and involves a combination of keyword searches, user profiling,
8
and other, “extensive but little discussed technology,” 42 all of which enables Facebook to gather
9
additional private information about its users.
10
59.
As discussed in paragraph 63, the “Like” function is crucial in gathering data
11
points for the profiles Facebook keeps on its users for profit, including for purposes of delivering
12
targeted advertising.
13
60.
The practice, purpose, and effect of scanning users’ private messages, as described
14
herein, are not disclosed by Facebook to its users, and these scans are undertaken without users’
15
consent.
16
61.
The practice, purpose, and effect of scanning users’ private messages, as described
17
herein, are not necessary for the rendition of Facebook’s private messaging service, the
18
protection of Facebook’s rights or property, or the security of Facebook users. These scans are
19
not undertaken in the ordinary course of business of an electronic communication service, as
20
described in 28 U.S.C. § 2510(15).
21
4.
22
62.
Facebook’s Incentive: Mining User Data
As information is shared by its more than one billion unique users, Facebook is
23
provided with sophisticated, exceedingly detailed data profiles. These vast databases of
24
individual user information and behavior, coupled with proprietary analytics algorithms, enable
25
40
26
27
28
Id., citing Facebook.com, Facebook Developers: Social Plugins: Like Button,
https://developers.facebook.com/docs/plugins/like-button/.
41
Joseph Menn, Social Networks Scan For Sexual Predators, With Uneven Results, Reuters (July
12, 2012), http://www.reuters.com/article/2012/07/12/us-usa-internet-predatorsidUSBRE86B05G20120712.
42
Id.
1147096.1
- 16 -
CLASS ACTION COMPLAINT
1
Facebook to surgically place ads throughout users’ accounts based upon the extensive profiles
2
assembled on each and every user. As the Company explains:
3
8
When an advertiser creates an ad, they are given the opportunity to
choose their audience by location, demographics, likes, keywords,
and any other information we receive or can tell about you and
other users. For example, an advertiser can choose to target 18 to 35
year-old women who live in the United States and like basketball.
An advertiser could also choose to target certain topics or
keywords, like “music” or even people who like a particular song or
artist. If you indicate that you are interested in topics, such as by
liking a Page, including topics such as products, brands, religion,
health status, or political views, you may see ads related to those
topics as well.
9
****
10
Sometimes we allow advertisers to target a category of user, like a
“moviegoer” or a “sci-fi fan.” We do this by bundling
characteristics that we believe are related to the category. For
example, if a person “likes” the “Star Trek” Page and mentions
“Star Wars” when they check into a movie theater, we may
conclude that this person is likely to be a sci-fi fan. Advertisers of
sci-fi movies, for example, could ask us to target “sci-fi fans” and
we would target that group, which may include you. Or if you
“like” Pages that are car-related and mention a particular car brand
in a post, we might put you in the “potential car buyer” category
and let a car brand target to that group, which would include you. 43
4
5
6
7
11
12
13
14
15
16
63.
As the above statement by the Company makes clear, “Likes” are essential to
17
Facebook in its creation of data profiles for each of its users. These data profiles in turn enable
18
Facebook to deliver ads with industry-leading accuracy. According to a third-party study,
19
broadly targeted campaigns on Facebook (e.g., adults between the ages of 25 and 49) reach the
20
desired audience with 95% accuracy, compared with an industry average of 72%; for more
21
narrowly targeted campaigns (e.g., females between the ages of 25 and 34), Facebook reaches the
22
desired audience with 90% accuracy, compared to an industry average of just 35%. 44
23
24
64.
In 2009, 2010, and 2011, targeted advertising accounted for 98%, 95%, and 85%,
respectively, of the Company’s revenue. 45
25
26
27
28
43
Data Use Policy, IV. How Advertising and Sponsored Stories Work, Facebook (updated
Dec. 11, 2012), http://www.scribd.com/doc/191118234/Facebook-2.
44
Form S-1 Registration Statement for Facebook, Inc., How We Create Value for Advertisers and
Marketers, 76.
45
Id., Risks Related to Our Business and Industry, 12.
1147096.1
- 17 -
CLASS ACTION COMPLAINT
1
65.
However, as discussed throughout this Complaint, Facebook’s desire to harness
2
the myriad data points of its users has led to overreach and intrusion on the part of the Company
3
as it mines its account holders’ private communications for monetary gain.
4
C.
5
1.
6
7
8
Facebook Employs Devices and/or Technology to Scan, Extract, Acquire, and
Use the Contents of Its Users’ Messages.
66.
Web Crawlers and Social Plugins
Upon information and belief, Facebook uses a software application called a “web
crawler” to scan any URL contained in a user’s private message.
9
67.
These web crawlers perform the automated task of scanning the URL by sending
10
HTTP requests to the server associated with the URL and then seeking various items of
11
information about the web page to which the URL is linked.
12
68.
As discussed in paragraphs 51-54, Facebook has developed items of code called
13
“social plugins,” which can be embedded in third-party websites and, when clicked on by visitors,
14
interact with Facebook.
15
69.
Such social plugins include, among others, the “Like” button. 46
16
70.
Upon information and belief, one of the items of information Facebook’s web
17
crawlers seek is whether or not the web page associated with the URL contains a “Like” button.
18
19
71.
web crawlers transmit this information back to Facebook.
20
21
72.
73.
74.
28
Upon information and belief, Facebook further uses these data to build and refine
user profiles.
26
27
Upon information and belief, Facebook further provides these data to the web page
at issue, in the form of analytical analysis of web traffic to that site by Facebook users.
24
25
Upon information and belief, Facebook then uses these data to register the URL
sent via private message as a “Like” for the web page.
22
23
Upon information and belief, where a web page does contain a “Like button, the
75.
Upon information and belief, Facebook’s interception occurs in transit, in
transmission, and/or in transfer of users’ private messages.
46
Product Docs: Social Plugins, Facebook, https://developers.facebook.com/docs/plugins/.
1147096.1
- 18 -
CLASS ACTION COMPLAINT
1
2.
2
76.
3
Facebook’s Message-Scanning Devices and/or Technology Constitute
Conduct Outside the Scope of the Company’s Ordinary Course of
Business.
None of the practices complained of throughout this complaint are necessary for or
4
incidental to the ability to send or receive private messages – an electronic communication
5
service – across Facebook’s online social network.
77.
6
7
Facebook has the technical capacity to offer its private message service without
intercepting, scanning, and using the content of Plaintiffs’ and Class Members’ private messages.
78.
8
Facebook’s acquisition and use of content from Plaintiffs’ and Class Members’
9
electronic communications, as described in this Complaint, is not necessary for or incidental to
10
the protection of the rights or property of the Company, as provider of the service. Indeed, such
11
activities, as described herein, are outside the ordinary course of business of electronic
12
communication service providers.
13
D.
14
Facebook Fails to Disclose That Its Private Message Processes Read, Acquire,
and Use Private Message Content, in Violation of Its Express Agreements
With Facebook Users.
15
1.
16
79.
17
No user consents to Facebook’s unlawful conduct because Facebook’s
Statement of Rights and Responsibilities and Privacy Policy are silent
on the private-message-scanning processes.
In order to establish a Facebook account, a user must agree to the Company’s
18
Statement of Rights and Responsibilities and its Privacy Policy. Specifically, on Facebook’s
19
main page, it states, “By clicking Sign Up, you agree to our Terms and that you have read our
20
Data Use Policy, including our Cookie Use.” 47 Within this sentence, the word “Terms” contains
21
a hyperlink, leading to Facebook’s “Statement of Rights and Responsibilities;” 48 similarly, the
22
words “Data Use Policy” contain a hyperlink, leading to Facebook’s “Data Use Policy.” 49
23
2.
80.
24
25
28
The Statement of Rights and Responsibilities informs users that
This Statement of Rights and Responsibilities (“Statement,”
“Terms,” or “SRR”) derives from the Facebook Principles, and is
our terms of service that governs our relationship with users and
26
27
Facebook’s Statement of Rights and Responsibilities
47
Facebook, https://www.facebook.com.
Statement of Rights and Responsibilities, Facebook, https://www.facebook.com/legal/terms.
49
Data Use Policy, Facebook, https://www.facebook.com/about/privacy.
48
1147096.1
- 19 -
CLASS ACTION COMPLAINT
1
others who interact with Facebook. By using or accessing
Facebook, you agree to this Statement, as updated from time to time
in accordance with Section 14 below. Additionally, you will find
resources at the end of this document that help you understand how
Facebook works.
2
3
4
(emphasis added).
5
81.
6
is titled “Privacy.” It consists of three sentences:
7
Your privacy is very important to us. We designed our Data Use
Policy50 to make important disclosures about how you can use
Facebook to share with others and how we collect and can use your
content and information. We encourage you to read the Data Use
Policy, and to use it to help you make informed decisions.
8
9
82.
10
11
The very first enumerated section of the Statement of Rights and Responsibilities
The above language incorporates Facebook’s Data Use Policy by reference, and
designates this document as governing the Company’s privacy policy with its users.
12
3.
83.
13
Facebook’s Data Use Policy
The term “message” is found in Facebook’s Data Use Policy (“the Policy”) only
14
nine times, and only once contemplates the Company receiving data related to users’ private
15
messages. Specifically, under the heading “Information we receive and how it is used,” the
16
Company states:
17
Other information we receive about you
18
We also receive other types of information about you:
•
19
20
21
We receive data about you whenever you use or are running
Facebook, such as when you look at another person’s
timeline, send or receive a message, search for a friend or a
Page, click on, view or otherwise interact with things, use a
Facebook mobile app, or make purchases through
Facebook. 51
22
23
24
25
26
27
28
50
As with the disclosure on the main page, “www.facebook.com,” the words “Data Use Policy”
contain a hyperlink leading to https://www.facebook.com/about/privacy/.
51
Data Use Policy: Information we receive and how it is used, Facebook,
https://www.facebook.com/full_data_use_policy. There have been minor revisions to this
language during the class period, not one of which is material to the allegations contained herein.
Prior to November 15, 2013, this language read: “We receive data about you whenever you
interact with Facebook, such as when you look at another person’s timeline, send or receive a
message, search for a friend or a Page, click on, view or otherwise interact with things, use a
Facebook mobile app, or purchase Facebook Credits or make other purchases through Facebook.”
1147096.1
- 20 -
CLASS ACTION COMPLAINT
1
2
84.
Under the section titled “How we use the information we receive,” the Policy
states:
3
We use the information we receive about you in connection with
the services and features we provide to you and other users like
your friends, our partners, the advertisers that purchase ads on the
site, and the developers that build the games, applications, and
websites you use. For example, in addition to helping people see
and find things that you do and share, we may use the information
we receive about you:
4
5
6
7

8
9


10

11

12
13
14

15
16
as part of our efforts to keep Facebook products, services and
integrations safe and secure;
to protect Facebook’s or others’ rights or property;
to provide you with location features and services, like telling
you and your friends when something is going on nearby;
to measure or understand the effectiveness of ads you and
others see, including to deliver relevant ads to you;
to make suggestions to you and other users on Facebook, such
as: suggesting that your friend use our contact importer because
you found friends using it, suggesting that another user add you
as a friend because the user imported the same email address as
you did, or suggesting that your friend tag you in a picture they
have uploaded with you in it; and
for internal operations, including troubleshooting, data analysis,
testing, research and service improvement.
***
17
While you are allowing us to use the information we receive about
you, you always own all of your information. Your trust is
important to us, which is why we don’t share information we
receive about you with others unless we have:
18
19


20
21

22
received your permission;
given you notice, such as by telling you about it in this policy;
or
removed your name or any other personally identifying
information from it.
23
85.
24
These disclosures do not disclose that as a matter of course Facebook scans,
25
mines, and manipulates the content of its users’ private messages, acting in a manner in direct
26
conflict with the assurances it provides to its users regarding the privacy and control they should
27
expect in using Facebook’s services. See ¶¶ 38-44, etc., supra.
28
1147096.1
- 21 -
CLASS ACTION COMPLAINT
1
86.
In contrast to its disclosures to developers discussed in paragraph 57, supra,
2
Facebook’s disclosures to users do not state that Facebook scans URLs transmitted via private
3
message across its social network.
4
87.
In contrast to its disclosures to developers discussed in paragraph 57, supra,
5
Facebook’s disclosures to users do not state that Facebook will register the fact that a URL is
6
communicated privately, via its private message function, as a “Like” for a particular web page.
7
88.
In contrast to its disclosures to developers discussed in paragraph 57, supra,
8
Facebook’s disclosures to users do not state that, when a user sends a URL as part of a private
9
message, this act will become part of Facebook’s data profile of web traffic for the linked-to
10
website.
11
89.
In contrast to its disclosures to developers discussed in paragraph 57, supra,
12
Facebook’s disclosures to users do not state that, when a user sends a URL as part of a private
13
message, this act will become part of Facebook’s data profile of the user.
14
90.
Instead, Facebook misleads users into believing that they have a secure, private
15
mechanism for communication – Facebook’s private messaging function – when, in fact,
16
Facebook intercepts and scans the content and treats portions of that content no differently than a
17
public “Like” or post, broadcast openly across the Internet. Further, the purpose for the invasive
18
scanning of these purportedly “private” messages is not meant for the benefit of users, but rather
19
is a mechanism for Facebook to surreptitiously gather data in an effort to improve its marketing
20
algorithms and increase its ability to profit from data about Facebook users.
21
CLASS ALLEGATIONS
22
23
91.
Rules of Civil Procedure, individually and on behalf of all members of the following Class:
24
All natural person Facebook users located within the United States
who have sent or received private messages where such message
included URLs in the content, from within two years before the
filing of this action up through and including the date of the
judgment in this case.
25
26
27
28
Plaintiffs bring this nationwide class action, pursuant to Rule 23 of the Federal
92.
Excluded from the Class are the following individuals and/or entities: Facebook
and its parents, subsidiaries, affiliates, officers and directors, current or former employees, and
1147096.1
- 22 -
CLASS ACTION COMPLAINT
1
any entity in which Facebook has a controlling interest; all individuals who make a timely
2
election to be excluded from this proceeding using the correct protocol for opting out; any and all
3
federal, state or local governments, including but not limited to their departments, agencies,
4
divisions, bureaus, boards, sections, groups, counsels and/or subdivisions; and all judges assigned
5
to hear any aspect of this litigation, as well as their immediate family members.
6
7
93.
Plaintiffs reserve the right to modify or amend the definition of the proposed Class
before the Court determines whether certification is appropriate.
8
94.
The Class is so numerous that joinder of all members is impracticable. Upon
9
information and belief, there are more than 166 million Facebook account holders in the United
10
States. The number of separate individuals who sent private messages via Facebook, where such
11
message included URLs in the content, within two years before the filing of this action, is likely
12
in the millions, and is identifiable and ascertainable based on Facebook’s records.
13
14
95.
There are questions of law or fact common to the Class. These questions include,
but are not limited to, the following:
15
a.
Whether Facebook intentionally intercepted, endeavored to intercept, or
16
procured any other person to intercept or endeavor to intercept Plaintiffs’ and Class Members’
17
electronic communications sent via Facebook;
18
b.
Whether Facebook intentionally used, or endeavored to use, the contents of
19
Plaintiffs’ and Class Members’ electronic communications sent via Facebook, knowing or having
20
reason to know that the information was obtained in violation of 18 U.S.C. § 2511(1)(d);
21
c.
Whether Facebook acted intentionally in violating privacy rights;
22
d.
Whether Facebook acquired any “contents” of Plaintiffs’ and Class
23
Members’ private messages, within the meaning of 18 U.S.C. § 2510(8);
24
25
e.
Facebook were “electronic communications” within the meaning of 18 U.S.C. § 2510(12);
26
27
Whether Plaintiffs’ and Class Members’ private messages sent via
f.
Whether Facebook used an “electronic, mechanical, or other device,”
within the meaning of 18 U.S.C. § 2510(5);
28
g.
1147096.1
The amount of statutory damages that should be levied against Facebook;
- 23 -
CLASS ACTION COMPLAINT
1
h.
Whether injunctive and/or declaratory relief against Facebook should be
3
i.
Whether Facebook’s conduct was likely to deceive its users;
4
j.
Whether Facebook’s conduct was unlawful; and
5
k.
Whether Plaintiffs and Class Members are entitled to restitution.
2
awarded;
6
96.
Plaintiffs’ claims are typical of the claims of the Class in that Plaintiffs and the
7
Class sent and/or received private messages via Facebook, where such messages contained URLs
8
in the content. In the process, Facebook intercepted, scanned, and acquired the private messages’
9
content, sending HTTP requests to the servers housing the web pages referred to in Plaintiffs’ and
10
Class Members’ private messages. Facebook further used or endeavored to use the contents of
11
Plaintiffs’ and Class Members’ private messages, where the Company found URLs to webpages
12
containing social plugins, manipulating such social plugins to generate “Likes” for web pages and
13
to assemble profiles of users’ web traffic and personal preferences. Plaintiffs and Class Members
14
did not consent to the interception and uses of their private message content, which comprise the
15
basis for this suit. Plaintiffs and Class Members are entitled to declaratory relief, statutory
16
damages, restitution, and injunctive relief as a result of the conduct complained of herein.
17
Moreover, upon information and belief, the conduct complained of herein is systemic. Thus, the
18
representative Plaintiffs, like all other Class Members, face substantial risk of the same injury in
19
the future. The factual basis of Facebook’s conduct is common to all Class Members, and
20
represents a common thread of conduct resulting in injury to all members of the Class. Plaintiffs
21
have suffered the harm alleged and have no interests antagonistic to any other Class Member.
22
97.
Plaintiffs will fairly and adequately protect the interests of the Class. Plaintiffs’
23
interests do not conflict with the interests of the Class Members. Furthermore, Plaintiffs have
24
retained competent counsel experienced in class action litigation. Plaintiffs’ counsel will fairly
25
and adequately protect and represent the interests of the Class. Fed. R. Civ. P. 23(a)(4) and 23(g)
26
are satisfied.
27
28
1147096.1
- 24 -
CLASS ACTION COMPLAINT
1
98.
Plaintiffs assert that pursuant to Fed. R. Civ. P. 23(b)(3), questions of law or fact
2
common to the Class Members predominate over any questions affecting only individual
3
members.
4
99.
A class action is superior to other available methods for the fair and efficient
5
adjudication of this controversy. Arguably no Class Member could afford to seek legal redress
6
individually for the claims alleged herein. Therefore, absent a class action, the Class Members
7
will continue to suffer losses and Facebook’s misconduct will proceed without remedy.
8
9
100.
Even if Class Members themselves could afford such individual litigation, the
court system could not. Given the complex legal and factual issues involved, and considering that
10
the Class could number in the tens of millions or greater, individualized litigation would
11
significantly increase the delay and expense to all parties and to the Court. Individualized
12
litigation would also create the potential for inconsistent or contradictory rulings. By contrast, a
13
class action presents far fewer management difficulties, allows claims to be heard which may
14
otherwise go unheard because of the relative expense of bringing individual lawsuits, and
15
provides the benefits of adjudication, economies of scale and comprehensive supervision by a
16
single court.
17
CAUSES OF ACTION
18
COUNT ONE
(Violations of the Electronic Communications Privacy Act,
18 U.S.C. §§ 2510 et seq.)
19
20
101.
21
stated fully herein.
22
102.
Plaintiffs adopt and incorporate each and every allegation of this complaint as if
Plaintiffs, individually and on behalf of Class Members, assert violations of
23
18 U.S.C. §§ 2511(1)(a) and (1)(d) for Facebook’s unlawful interception and use of Plaintiffs’
24
electronic communications.
25
103.
Facebook, as a corporation, is a “person” pursuant to 18 U.S.C. § 2510(6).
26
104.
Throughout the entirety of the conduct upon which this suit is based, Facebook’s
27
actions have affected interstate commerce. Upon information and belief, the Company has over
28
166 million users in the United States alone, and over one billion users worldwide.
1147096.1
- 25 -
CLASS ACTION COMPLAINT
1
105.
Facebook’s actions are and have been intentional as evidenced by, inter alia, its
2
disclosures to developers and the design and implementation of its private messaging service,
3
web crawlers, and social plugins.
4
106.
Facebook’s actions complained of herein are not necessary practices for providers
5
of electronic communications, nor are they incidental to the act of facilitating private messages
6
across Facebook’s social network.
7
107.
Pursuant to 18 U.S.C. § 2511(1)(a), Facebook intentionally intercepted, intercepts,
8
or endeavored or endeavors to intercept the electronic communications of Plaintiffs and Class
9
Members.
10
108.
Through Facebook’s scanning of users’ private messages, the Company acquired
11
and continues to acquire the substance, purport, and meaning of private messages transmitted to
12
and from Plaintiffs and Class Members.
13
109.
The private messages transmitted to and from Plaintiffs and Class Members via
14
Facebook’s private messaging function are and have been at all relevant times electronic
15
communications.
16
110.
The conduct alleged herein does not occur while the private message is in storage.
17
Rather, Facebook utilizes each accused device for the purpose of acquiring and manipulating
18
content from the message in the course of the message’s transmission.
19
111.
Facebook utilized and continues to utilize one or more devices or technology
20
comprised of an electronic, mechanical, or other device or apparatus to intercept the electronic
21
communications transmitted to and from Plaintiffs and Class Members. Such devices or
22
technology include, but are not limited to, web crawlers and social plugins.
23
24
112.
and users do not use the devices for connection to the facilities.
25
26
Facebook does not furnish the above-referenced devices or technology to its users,
113.
The intercepting devices or technology are not used for the ability to send or
receive electronic communications.
27
28
1147096.1
- 26 -
CLASS ACTION COMPLAINT
1
114.
The devices or technology are not used by Facebook, operating as an electronic
2
communication service, in the ordinary course of business as a provider of an electronic
3
communication service.
4
115.
Facebook’s interception of electronic communications sent by and to Plaintiffs and
5
Class Members (a) for undisclosed purposes; (b) for the purpose of generating “Likes” for third-
6
party websites; (c) for purposes of providing web traffic data to third parties; (d) for purposes of
7
cataloging user data for targeted advertising and building user profiles; (e) for purposes beyond
8
facilitating private messages sent via Facebook; (f) in violation of its user agreements; (g) in
9
violation of its public statements to users; (h) in violation of federal and California law; and (i) in
10
violation of the property rights of Plaintiffs, Class Members, and third parties. These activities
11
are not within the ordinary course of business of a provider of an electronic communication
12
service.
13
116.
Pursuant to 18 U.S.C. § 2511(1)(d), Facebook intentionally used, uses, or
14
endeavored or endeavors to use the contents of Plaintiffs’ and Class Members’ electronic
15
communications while knowing or having reason to know that it obtained the information through
16
the interception of the electronic communication in violation of 18 U.S.C. § 2511(1)(a).
17
117.
Facebook’s interception of and use of the contents of Plaintiffs’ and Class
18
Members’ electronic communications were not performed by an employee engaged in any
19
activity necessary for the rendition of an electronic communication service or for the protection of
20
the rights or property of Facebook.
21
22
118.
communications are not electronic communication services.
23
24
Facebook’s services that are not related to the ability to send and receive electronic
119.
No party to the electronic communications alleged herein consented to Facebook’s
interception or use of the contents of the electronic communications.
25
120.
Facebook intercepts Plaintiffs’ and Class Members’ electronic communications for
26
the purpose of committing a criminal or tortious act in violation of the laws of any state, and as
27
such, it cannot obtain consent pursuant to § 2511(2)(d).
28
1147096.1
- 27 -
CLASS ACTION COMPLAINT
1
2
121.
As a result of Facebook’s violations of § 2511, pursuant to § 2520, Plaintiffs and
the Class Members are entitled to:
3
a.
Preliminary and permanent injunctive relief to require Facebook to fully
4
disclose the extent of its activities, to seek the informed and knowing consent of its users when
5
scanning users’ private messages, and to halt Facebook’s violations;
6
b.
Appropriate declaratory relief;
7
c.
For Plaintiffs and each Class Member, the greater of $100 a day for each
8
day of violation or $10,000; and
9
d.
10
122.
Reasonable attorney’s fees and other litigation costs reasonably incurred.
While certain devices and/or technology have been identified in this Complaint,
11
Plaintiffs reserve the right to assert ECPA violations as to any further devices and/or technology
12
disclosed or those devices and/or technology upon which Facebook provides additional
13
information.
14
COUNT TWO
(Violations of the California Invasion of Privacy Act,
Cal. Penal Code §§ 630, et seq.)
15
16
123.
17
stated fully herein.
18
124.
Plaintiffs adopt and incorporate each and every allegation of this complaint as if
Plaintiffs, individually and on behalf of Class Members, assert violations of the
19
CIPA, Cal. Penal Code §§ 630, et seq., specifically Cal. Penal Code §§ 631(a) and 632, for
20
Facebook’s unlawful interception and scanning of the contents of its users’ private messages.
21
Facebook uses this information about the sender and recipient for purposes of profiling,
22
marketing, and advertising.
23
125.
Cal. Penal Code § 630 provides that “The Legislature hereby declares that
24
advances in science and technology have led to the development of new devices and techniques
25
for the purpose of eavesdropping upon private communications and that the invasion of privacy
26
resulting from the continual and increasing use of such devices and techniques has created a
27
serious threat to the free exercise of personal liberties and cannot be tolerated in a free and
28
civilized society.”
1147096.1
- 28 -
CLASS ACTION COMPLAINT
1
126.
Facebook’s acts in violation of the CIPA occurred in the State of California
2
because those acts resulted from business decisions, practices, and operating policies that
3
Facebook developed, implemented, and utilized in the State of California and which are unlawful
4
and constitute criminal conduct in the state of Facebook’s residence and principal business
5
operations. Facebook’s implementation of its business decisions, practices, and standard ongoing
6
policies that violate the CIPA took place and continue to take place in the State of California.
7
Facebook profited and continues to profit in the State of California as a result of its repeated and
8
systemic violations of the CIPA. Facebook’s unlawful conduct, which occurred in the State of
9
California, harmed and continues to harm Plaintiffs and Class Members. Facebook developed,
10
designed, built, and physically placed in California one or more of the accused devices or
11
technology employed by Facebook to violate the CIPA.
12
13
127.
which included URLs, via Facebook’s services.
14
15
128.
Facebook is not and was not at any time a party to Plaintiffs’ and Class Members’
private messages.
16
17
Plaintiffs and Class Members sent and received private messages, the contents of
129.
The private messages exchanged among Plaintiffs and Class Members are
messages.
18
130.
These messages are communications among Plaintiffs and Class Members.
19
A.
Violations of Cal. Penal Code § 631(a)
20
131.
Pursuant to Cal. Penal Code § 7, Facebook, a corporation, is a “person.”
21
132.
Facebook uses a “machine,” “instrument,” “contrivance,” or “in any other manner”
22
is able to, read or to learn the content or meaning of Plaintiffs’ and Class Members’ private
23
messages.
24
25
133.
Facebook acts willfully when it reads, attempts to read, or learns the content or
meaning of Plaintiffs’ and Class Members’ private messages.
26
134.
Facebook does not have the consent of any party to the communication, or it acts
27
in an unauthorized manner, when it reads, attempts to read, or learns the content or meaning of
28
Plaintiffs’ and Class Members’ private messages.
1147096.1
- 29 -
CLASS ACTION COMPLAINT
1
2
135.
communication.”
3
4
Plaintiffs’ and Class Members’ private messages are “any message, report, or
136.
At the time Facebook reads, attempts to read, or learns the content or meaning of
Plaintiffs’ and Class Members’ private messages, the private messages are in transit.
5
137.
At the time Facebook reads, attempts to read, or learns the content or meaning of
6
Plaintiffs’ and Class Members’ private messages, the private messages are passing over any wire,
7
line, or cable.
8
9
138.
Private messages – coded, written messages sent electronically to remote locations
– are telegraphs within the meaning of the CIPA and this section of CIPA. As such, the wires,
10
lines, cables and/or instruments which carry and facilitate the transmission of Plaintiffs’ and Class
11
Members’ private messages are telegraph wires, lines, cables and/or instruments within the
12
meaning of the CIPA and CIPA § 631(a).
13
139.
Plaintiffs and Class Members do not consent, expressly or impliedly, to
14
Facebook’s eavesdropping upon and recording of their private messages. Facebook does not
15
disclose material information to its users relating to its attempts at, among other things,
16
intercepting, scanning and reading the contents of users’ private messages.
17
140.
There is no knowledge or expectation among Plaintiffs and Class Members
18
regarding the extent of Facebook’s reading of message content, learning about the content or
19
meaning of users’ private messages, the acquisition of such content, the collection of such
20
content, or the manipulation of such content. Each and every one of these actions extends beyond
21
the normal occurrences, requirements, and expectations regarding the facilitation and
22
transmission of Facebook’s private messages.
23
B.
Violations of Cal. Penal Code § 632
24
141.
Pursuant to Cal. Penal Code §§ 7 and 632(b), Facebook, a corporation, is a
25
“person.”
26
27
142.
Cal. Penal Code § 632 prohibits eavesdropping upon or the recording of any
confidential communication, including those occurring by telephone, telegraph or other device,
28
1147096.1
- 30 -
CLASS ACTION COMPLAINT
1
through the use of an amplification or electronic recording device without the consent of all
2
parties to the communication.
3
4
143.
Facebook intentionally and without the consent of any party to the communication
eavesdrops upon and/or records the contents of Plaintiffs’ and Class Members’ private messages.
5
144.
Facebook uses electronic amplifying or recording devices, including its web
6
crawlers and social plugins, to eavesdrop upon and to record Plaintiffs’ and Class Members’
7
private messages, for purposes independent and unrelated to storage.
8
9
145.
Plaintiffs’ and Class Members’ private messages are confidential communications
with specifically identified and designated recipients.
10
146.
At the time Plaintiffs and Class Members transmit private messages via Facebook,
11
their communications are confidential because the communications are confined to those persons
12
specified as recipients in the destination address fields. There neither would nor could be any
13
expectation that a third party, such as Facebook, would act in any manner other than to facilitate
14
the communication of the private message between the sender and the intended recipient or
15
recipients. There certainly would not and could not be any expectation that Facebook – a third
16
party – would scan the contents of the private message in an effort to catalog and manipulate the
17
information contained therein.
18
147.
There is no knowledge or expectation among Plaintiffs and Class Members
19
regarding the extent of Facebook’s reading of users’ private message content, learning about the
20
content or meaning of the private messages, acquiring and collecting the content of such
21
messages, and manipulating the content of such messages – each action being beyond the normal
22
occurrences, requirements, and expectations regarding the facilitation and transmission of
23
Facebook’s private messages.
24
25
148.
among the parties by means of an electronic device that is not a radio.
26
27
Plaintiffs’ and Class Members’ private messages sent via Facebook are carried on
149.
Plaintiffs and Class Members do not consent, expressly or impliedly, to
Facebook’s eavesdropping upon and recording of their private messages. Facebook does not
28
1147096.1
- 31 -
CLASS ACTION COMPLAINT
1
disclose material information to its users relating to its attempts at reading, scanning, acquiring,
2
collecting, and manipulating the contents of users’ private messages.
3
150.
While Plaintiffs have identified certain accused devices and/or technology in this
4
Complaint, Plaintiffs reserve the right to assert violations of Cal. Penal Code §§ 631 and 632 as to
5
any further devices or technology subsequently discovered or any devices or technology upon
6
which Facebook provides additional information.
7
C.
Relief Sought Under Cal. Penal Code § 637.2
8
151.
As a result of Facebook’s violations of Cal. Penal Code §§ 631 and 632, Plaintiffs
9
and the Class are entitled to:
10
a.
Preliminary and permanent injunctive relief to require Facebook to fully
11
disclose the extent of its activities, to seek the informed and knowing consent of its users when
12
scanning users’ private messages, and to halt Facebook’s violations;
13
b.
Appropriate declaratory relief;
14
c.
Monetary relief in the amount set forth in Cal. Penal Code § 637.2(a) for
15
each Class Member; and
16
d.
17
COUNT THREE
(Violations of California’s Unfair Competition Law
California Business & Professions Code § 17200 et seq.)
18
19
20
152.
23
153.
26
Professions Code (“UCL”).
154.
Facebook’s conduct constitutes “unlawful” business acts or practices by virtue of
Defendant’s violation of the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510, et seq.,
Cal. Penal Code §§ 631(a) and 632.
27
28
Facebook’s conduct as alleged herein constitutes unfair, unlawful, or fraudulent
business acts or practices as proscribed by Section 17200, et seq., of the California Business &
24
25
Plaintiffs and Class Members reallege and incorporate by reference every
allegation set forth in the preceding paragraphs as though alleged in this Count.
21
22
Reasonable attorney’s fees and other litigation costs reasonably incurred.
155.
Plaintiffs reasonably relied on Facebook’s representations that Plaintiffs’ private
messages are viewable only by the sender and the recipient, and as a result engaged in “private”
1147096.1
- 32 -
CLASS ACTION COMPLAINT
1
messaging on Facebook. Facebook failed to disclose to Plaintiffs and members of the general
2
public that it systematically reviews and captures the content of, and metadata associated with,
3
Plaintiffs’ private messages. Facebook failed to disclose that it aggregates the content and data of
4
private messages, using it to sell advertising for a profit. Facebook’s Data Use Policy fails to
5
disclose Facebook’s acts or practices, and together with its statements that private messages are
6
viewable only by the sender and the recipient, are likely to deceive members of the public. As a
7
result, Facebook’s conduct constitutes “fraudulent” business acts or practices.
8
9
156.
Plaintiffs have an interest in controlling the disposition and dissemination of their
private messages. Contrary to Plaintiffs’ interests, Facebook exercised control over the content of
10
Plaintiffs’ private messages, exploiting it for sale and profit without Plaintiffs’ consent. As a
11
result, Facebook’s conduct constitutes “unfair” business acts or practices.
12
13
157.
Plaintiffs have suffered injury in fact and lost money or property as a result of
Facebook’s business acts or practices.
14
158.
Plaintiffs and Class Members seek an order to enjoin Facebook from such
15
unlawful, unfair, and fraudulent business acts or practices, and to restore to Plaintiffs and Class
16
Members their interest in money or property that may have been acquired by Facebook by means
17
of unfair competition.
18
JURY DEMANDED
19
20
Pursuant to Federal Rule of Civil Procedure 38, Plaintiffs, individually and on behalf of
the Class they seek to represent, demand a jury on any issue so triable of right by a jury.
21
PRAYER FOR RELIEF
22
23
WHEREFORE, Plaintiffs, on behalf of themselves and all Class Members, request
judgment be entered against Facebook and that the Court grant the following:
24
1.
An order determining that this action may be maintained as a class action under
25
Rule 23 of the Federal Rules of Civil Procedure, that Plaintiffs are proper class representatives,
26
that Plaintiffs’ attorneys be appointed Class counsel pursuant to Rule 23(g) of the Federal Rules
27
of Civil Procedure, and that Class notice be promptly issued;
28
1147096.1
- 33 -
CLASS ACTION COMPLAINT
1
2.
Judgment against Facebook for Plaintiffs’ and Class Members’ asserted causes of
3
3.
Appropriate declaratory relief against Facebook;
4
4.
Preliminary and permanent injunctive relief against Facebook;
5
5.
An award of statutory damages to Plaintiffs and Class Members pursuant to
2
action;
6
18 U.S.C. § 2520, for each, the greater of $100 a day for each day of violation of Count One, or
7
$10,000;
8
6.
9
10
Penal Code § 637.2, for each, the greater of $5,000 or three times the amount of actual damages
sustained by Plaintiffs and Class Members;
11
12
An award of statutory damages to Plaintiffs and Class Members pursuant to Cal.
7.
An award of reasonable attorney’s fees and other litigation costs reasonably
incurred; and
13
8.
Any and all relief to which Plaintiffs and the Class may be entitled.
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
1147096.1
- 34 -
CLASS ACTION COMPLAINT
1
Dated: December 30, 2013
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
2
3
By:
4
/s/ Michael W. Sobol
Michael W. Sobol
Michael W. Sobol (State Bar No. 194857)
msobol@lchb.com
Melissa Gardner (State Bar No. 289096)
mgardner@lchb.com
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: 415.956.1000
Facsimile: 415.956.1008
5
6
7
8
9
Rachel Geman
rgeman@lchb.com
Nicholas Diamand
ndiamand@lchb.com
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: 212.355.9500
Facsimile: 212.355.9592
10
11
12
13
14
Hank Bates (State Bar No. 167688)
hbates@cbplaw.com
Allen Carney
acarney@cbplaw.com
David Slade
dslade@cbplaw.com
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: 501.312.8500
Facsimile: 501.312.8505
15
16
17
18
19
20
Attorneys for Plaintiffs and the Proposed Class
21
22
23
24
25
26
27
28
1147096.1
- 35 -
CLASS ACTION COMPLAINT

The Justia Federal District Court Filings & Dockets site republishes public litigation records retrieved from the US Federal District Courts. These filings and docket sheets should not be considered findings of fact or liability, and do not necessarily reflect the view of Justia.